Compromised Microsoft 365 account: what Microsoft's response guide describes

When a Microsoft 365 account may be compromised, Microsoft’s response guide describes containing it first (disabling the account, or resetting the password if it can’t be disabled, then revoking sessions), removing anything the attacker added, investigating the logs and restoring access. This page summarises that guidance alongside what Scamwatch, ASIC and the ACSC describe. Microsoft’s own guide, Respond to a compromised email account, has the current navigation steps and PowerShell commands, and is the authority for the technical steps below. Microsoft says its steps address “known methods that might allow the attacker to maintain persistence and regain control of the account later”.

If money may have been sent

Scamwatch says to contact the bank or card provider immediately to report the scam and ask it to stop transactions. ASIC’s guidance for businesses also says to report the scam to the bank or financial institution and ask it to halt any transactions. What Scamwatch and ASIC say to do after a payment redirection and business email compromise explained cover this type of fraud.

Signs Microsoft lists

Microsoft’s guide lists these as possible signs that an account is compromised:

• the mailbox is blocked from sending email
• suspicious activity, such as missing or deleted email
• suspicious inbox rules, such as rules that forward email to unknown addresses or move messages to the Notes, Junk Email or RSS Subscriptions folders
• suspicious messages in Sent Items or Deleted Items
• changes to the user’s contact in the Global Address List
• frequent password changes or unexplained account lockouts
• recently added external email forwarding
• suspicious email signatures.

Steps Microsoft’s guide describes

Contain the account

1. Disable the account. Microsoft states that disabling the compromised account “is preferred and highly recommended” until the investigation is complete. If it can’t be disabled, Microsoft describes resetting the password as the next best step. Microsoft notes that the new password isn’t to be sent to the user by email, because the attacker could have access to the mailbox, and that app passwords aren’t automatically revoked when the password is reset; Microsoft says the user deletes existing app passwords and creates new ones.
2. Revoke user access. Microsoft explains that revoking active sessions immediately invalidates any active access using the stolen credentials.

How to block sign-in and revoke sessions

Microsoft’s response guide gives PowerShell commands for these two steps. Its separate page on revoking user access describes the same steps in the Microsoft Entra admin center. Based on Microsoft’s instructions (checked October 2026); Microsoft’s revoke access guide has the latest steps.

1. Go to Entra ID > Users > All users, and select the user.
2. Under Account status, select Edit.
3. In Properties, clear Account enabled, then select Save.
4. On the user’s Overview page, select Revoke sessions.

Microsoft’s page says disabling accounts needs the User Administrator role for non-admin users, or Privileged Authentication Administrator for admin accounts. It also notes that access tokens last for one hour by default, so some apps may keep working until the token expires.

Remove the attacker’s foothold

3. Review the MFA registered devices. Microsoft’s guide describes identifying and removing any suspicious devices added by an attacker.
4. Review applications with user consent. Microsoft describes removing and revoking any applications that shouldn’t be allowed. App consent in Entra ID explains consent phishing.
5. Review administrative roles. Microsoft describes removing any roles the user shouldn’t have. Microsoft 365 admin roles and least privilege explains the built-in roles.
6. Review mail forwarders. Microsoft describes removing suspicious mailbox forwarding and reviewing inbox rules, including hidden rules, that forward or redirect mail. Suspicious inbox rules and forwarding covers what Microsoft’s documentation says about these.

As part of the first step, Microsoft’s guide also states that it highly recommends enabling and enforcing multifactor authentication for the account.

Investigate

Microsoft’s guide describes reviewing audit logs from the onset of the suspicious activity until remediation is complete, using:

• Microsoft Entra sign-in logs and risk reports, looking at IP address, sign-in locations, sign-in times and success or failure (what Entra sign-in logs record)
• audit logs in the Microsoft Defender portal, filtered by a date range that starts just before the suspicious activity, without filtering for specific activities at first (how the Microsoft 365 audit log works)
• message trace in the Defender portal, and the contents of the account’s Sent Items folder in Outlook or Outlook on the web.

Restore

• Microsoft states that if the account was disabled during the investigation, the password is reset and then the account is enabled.
• Microsoft explains that if the account was used to send spam or a high volume of email, the mailbox is likely blocked from sending, and the user is removed from the Restricted entities page.

Reporting and communication, as ASIC and others describe

ASIC’s guidance for businesses that have been scammed describes:

• reporting to Scamwatch, including impersonations of the business
• reporting to ReportCyber, which ASIC says goes directly to the relevant police jurisdiction
• telling staff, clients and suppliers to watch for unusual requests, such as changed bank details or large transfers
• letting the ATO know if confidential taxpayer information may have been stolen
• contacting IDCARE, which ASIC says can help make a plan to limit the damage and is free for sole traders and small businesses (IDCARE’s website lists its small business and organisations helpline as 1800 595 170, and its individual helpline as 1800 595 160)
• being wary of follow-up scams, especially offers to recover money.

ASIC’s recovery steps for compromised accounts also include resetting passwords and turning on multi-factor authentication, reviewing account recovery details, signing out of all other sessions and devices, removing unrecognised third-party apps, deleting unrecognised email or call forwarding rules, and reviewing past transactions, sent and deleted emails and login activity. ASIC’s page also lists the ACSC 24/7 hotline, 1300 CYBER1 (1300 292 371).

Personal information. The OAIC explains that, under the Notifiable Data Breaches scheme, organisations covered by the Privacy Act must notify affected individuals and the OAIC when a data breach is likely to result in serious harm. Whether this applies depends on the organisation and the incident; the OAIC’s guidance and a qualified adviser are the places to check. This page isn’t legal advice.

See where to report scams and cybercrime in Australia for reporting details.

After the incident

The Microsoft 365 security checklist summarises the settings Microsoft’s documentation describes for reducing the chance of a repeat, including phishing-resistant MFA, blocking legacy authentication, restricting app consent and setting automatic external forwarding explicitly.

Common questions

What do I do if my Microsoft 365 account has been hacked?

Microsoft’s response guide describes disabling the account as preferred, or resetting the password if it can’t be disabled, and then revoking the user’s sessions. It then describes reviewing MFA registered devices, consented apps, admin roles and mail forwarding, investigating the logs, and re-enabling the account only after the password is reset. Steps Microsoft’s guide describes has the full order. For serious incidents, the ACSC’s 24/7 hotline is 1300 CYBER1 (1300 292 371).

How can I tell if a Microsoft 365 account is compromised?

Microsoft’s guide lists possible signs rather than a single test. They include the mailbox being blocked from sending, missing or deleted email, inbox rules that forward mail to unknown addresses or move messages to unusual folders, suspicious messages in Sent Items, recently added external forwarding, frequent password changes or unexplained lockouts, and suspicious email signatures. Signs Microsoft lists has the complete list.

Does resetting the password lock the attacker out?

Not on its own, according to Microsoft. Microsoft says app passwords aren’t automatically revoked when a password is reset, and describes revoking sessions to invalidate active access. Its revoke access page also notes that access tokens last one hour by default, so some apps may keep working until the token expires. Contain the account and How to block sign-in and revoke sessions cover these steps.

How do I block sign-in and revoke sessions in Microsoft 365?

Microsoft’s instructions use the Microsoft Entra admin center. Go to Entra ID > Users > All users, select the user, select Edit under Account status, clear Account enabled and save, then select Revoke sessions on the user’s Overview page. Microsoft says this needs the User Administrator role for non-admin users, or Privileged Authentication Administrator for admin accounts. How to block sign-in and revoke sessions links to Microsoft’s latest steps.

What happens if money was sent after an email account was compromised?

Scamwatch and ASIC say to contact the bank or financial institution straight away and ask it to stop or halt the transaction. ASIC’s guidance for businesses also describes reporting to Scamwatch and ReportCyber, warning staff, clients and suppliers about unusual requests, and being wary of follow-up offers to recover money. If money may have been sent links to the related guides on payment redirection.

Who do I report a hacked business email account to in Australia?

ASIC’s guidance describes reporting to ReportCyber, which it says goes directly to the relevant police jurisdiction, and to Scamwatch, including impersonations of the business. ASIC also describes contacting IDCARE for a plan to limit the damage, and lists the ACSC’s 24/7 hotline, 1300 CYBER1 (1300 292 371). Reporting and communication has the numbers and the OAIC note on personal information.